Update of bug #68725 (group groff):
Status: None => Confirmed
Summary: [refer] provide a "safer mode," and possibly default
to it => [refer] disclose nature of index file corruption and always ignore
them
_______________________________________________________
Follow-up Comment #2:
We have an undocumented `-V` option in _refer_(1), _lookbib_(1), and
_lkbib_(1).
$ git grep -C1 -w do_verify
ChangeLog.123- * src/utils/lookbib/lookbib.cpp: Demote `verify_flag` from an
ChangeLog.123: `int` to a `bool`, rename it to `do_verify`, use Boolean
ChangeLog.123- instead of integer literals with it, and update call sites.
ChangeLog.123-
ChangeLog.123: * src/libs/libbib/index.cpp: Rename `do_verify()` member
ChangeLog.123- function to `get_invalidity_reason()` (it returns a string).
--
src/include/search.h-extern const char *linear_ignore_fields;
src/include/search.h:extern bool do_verify;
src/include/search.h-
--
src/libs/libbib/index.cpp-
src/libs/libbib/index.cpp:bool do_verify = false;
src/libs/libbib/index.cpp-
--
src/libs/libbib/index.cpp- if (problem != 0 /* nullptr */) {
src/libs/libbib/index.cpp: if (do_verify)
src/libs/libbib/index.cpp- error("ignoring index file '%1' due to corrupt
header: %2", name,
--
src/libs/libbib/index.cpp- }
src/libs/libbib/index.cpp: else if (do_verify && !item->is_valid()) {
src/libs/libbib/index.cpp- delete item;
--
src/preproc/refer/refer.cpp- case 'V':
src/preproc/refer/refer.cpp: do_verify = true;
src/preproc/refer/refer.cpp- opt++;
--
src/utils/lkbib/lkbib.cpp- case 'V':
src/utils/lkbib/lkbib.cpp: do_verify = true;
src/utils/lkbib/lkbib.cpp- break;
--
src/utils/lookbib/lookbib.cpp- case 'V':
src/utils/lookbib/lookbib.cpp: do_verify = true;
src/utils/lookbib/lookbib.cpp- break;
Given that index file interpretation has caused us grief on at least two
separate occasions (several years apart), how little these tools are used, and
consequently how few people there are to annoy if they get a bit chattier, I
propose that instead of having a "safer mode", we just be "safer" all the
time, and angrily reject any index file that fails auditing. We can then get
rid of this `-V` option and act like `do_verify` is true, always.
I'm not sure how it makes any sense to read from a known corrupt file anyway.
Even if the code is as secure as Fort Knox, you run the risk of incorrect
information being injected into your document--because the wrong bibliographic
entry was matched, for example.
It's not like there's much of a performance hit anyway. And if someone should
find that there is, they should use _indxbib_(1) to reconstruct their
corrupted index files.
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68725>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
